{"action":"Upgrade net.sf.mpxj:mpxj to 8.1.4 or later.","affected":[{"fixed":"8.1.4","introduced":"0"}],"component":"net.sf.mpxj:mpxj","cve_ids":["CVE-2020-25020"],"ecosystem":"Maven","epss":0.02591,"exploited":false,"fixed_versions":["8.1.4"],"ghsa_id":"GHSA-wcp5-m52f-mhh5","id":"tcs_01M5N9G53917PM751CZVQ5SASZ","modified_at":"2023-11-08T04:03:09.238619Z","published_at":"2021-05-07T15:54:36Z","references":["https://osv.dev/vulnerability/GHSA-wcp5-m52f-mhh5","https://nvd.nist.gov/vuln/detail/CVE-2020-25020","https://github.com/joniles/mpxj/pull/178/commits/c3e457f7a16facfe563eade82b0fa8736a8c96f9","https://github.com/joniles/mpxj","https://github.com/joniles/mpxj/releases/tag/v8.1.4","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-wcp5-m52f-mhh5","url":"https://osv.dev/vulnerability/GHSA-wcp5-m52f-mhh5"}],"summary":"Improper Restriction of XML External Entity Reference in MPXJ"}